Patent 

2021906-7001772001 
(21906-702) 

CLAIM AMENDMENTS 

1 . (Currently Amended) A method to monitor of monitoring a network switch by a monitor 
dovico, said network switch having a plurality of regular ports between which network traffic data 
packets are forwarded and a mirror port , said mirror port b e ing able to mirror n e twork traffic for at 
least on e of said regular ports, said network switch coupling to said monitor device through said 
mirror port, said n e twork traffic comprising data packets forwarded between two of the plurality of 
regular ports , comprising: 

selecting at least one of said regular ports; 

(2) mirroring a data packet of the selected port to said mirror port; 

forwarding said data packet to a monitor devic e ; 

(4) extracting the network address information of said mirrored data packet in said 

monitor devic e; 

(§) determining port information of said network address information; and 

(6) performing network analysis of said network switch. 

2. (Currently Amended) The method to monitor a network switch according to of claim 1, 
wherein said port information r e f e rs to comprises physical information of said network address 
information in said network switch. 

3. (Currently Amended) The method to monitor a network switch according to claim 2 of 
claim L wherein said determining step comprising: port information determination c omprises 
interrogating said network switch to obtain said port information using said network address 
information. 
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4. (Currently Amended) The method to monitor a n e twork switch according to of claim 3, 
wherein said int e rrogating st e p comprising: interrogation comprises: 

sending a first request to said network switch requesting a port index corresponding to said 
network address information; and 

sending a second request to said network switch requesting said port information 
corresponding to said port index. 

5. (Currently Amended) The method to monitor a n e twork switch according to of claim 4, 
wherein said first request and said second request are SNMP requests. 

6. (Cancelled). 

7. (Currently Amended) The method to monitor a n e twork switch according to claim 5 of 
claim 1 , wherein said determining step comprising: port information determination comprises 
placing said mirrored data packet in a first-in- first-out buffer waiting for responses from said 
network switch. 

8. (Currently Amended) The method to monitor a n e twork switch according to of claim 7, 
wherein said determining st e p further comprising: port information determination further comprises 
releasing said mirrored data packet from said first-in- first-out buffer after said network switch 
responds to said SNMP requests. 

9. (Currently Amended) The method to monitor a n e twork switch according to of claim 7, 
wherein said d e t e rmining step furth e r comprising: port information determination further comprises 
releasing said mirrored data packet from said first-in- first-out buffer after a predetermined period of 
time. 
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10. (Currently Amended) The method to monitor a network switch according to of claim 1 , 
further comprising^ maintaining at least one lookup table correlating said network address 
information with said port information. 

11. (Currently Amended) The method to monitor a network switch according to of claim 1, 
wherein said network address information comprises a source address of said mirrored data packet. 

12. (Currently Amended) The method to monitor a network switch according to of claim 1, 
wherein said network address information comprises a destination address of said mirrored data 
packet. 

13. (Currently Amended) The method to monitor a network switch according to of claim 1, 
wherein said network switch is a routing switch. 

14. (Currently Amended) A method to monitor a network switc h by a monitor d e vic e, 
comprising: 

(4} obtaining at least a portion of data packets being handled by said network switch-te 

said monitor d e vic e, wherein each of said data packets comprises network address information; 

(3) extracting , in said monitor d e vic e , said network address information of from said data 

packets; 

(3) determining fee-port information of said network address information; and 

(4) performing network analysis of said network switch using said port information. 

15. (Currently Amended) The method to monitor a network switch according to of claim 14, 
wherein said port information refers to comprises physical information of said network address 
information in said network switch. 
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16. (Currently Amended) The method to monitor a n e twork switch according to claim H of 
claim 14, said network switch having a plurality of regular ports and a mirror port, said mirror port 
being able to mirror network traffic for at least one of said regular ports, said n e twork switch 
coupling to said monitor d e vice through said mirror port, wh e r e in th e data pack e ts are forward e d 
from aniH nntwork switch to naid monitor devic e through said mirror port , wherein said portion of 
data packets are obtained from said mirror port . 

17. (Currently Amended) The method to monitor a network switch according to claim 16 of 
claim 14 , wherein said network address information of said data packets comprises source addresses. 

18. (Currently Amended) The method to monitor a network switch according to claim 16 of 
claim 14 , wherein said network address information of said data pack e ts comprises destination 
addresses. 

19. (Currently Amended) The method to monitor a network switch according to claim 16 of 
claim 14 , said network switch comprising a plurality of regular ports, wherein said data packets are 
forward e d to said monitor d e vic e obtained by passively tapping at least one of said regular ports. 

20. (Currently Amended) The method to monitor a network switch according to claim 16 of 
claim 14 , wherein said determining step comprising: port information determination comprises 
interrogating said network switch to obtain said port information using said network address 
information. 

21. (Currently Amended) The method to monitor a network switch according to of claim 20, 
wherein said interrogating step comprising interrogation : 

sending a first request to said network switch requesting a port index corresponding to said 
network address information; and 
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sending a second request to said network switch requesting said port information 
corresponding to said port index. 

22. (Currently Amended) The method to monitor a n e twork switch according to of claim 21 , 
wherein said first request and said second request are SNMP requests. 

23. (Currently Amended) The method to monitor a network switch according to claim 22 of 
claim 21 , wherein said det e rmining stop comprising: port information determination comprises 
placing said data packets in a first-in-first-out buffer waiting for responses from said network switch. 

24. (Currently Amended) The method to monitor a network switch according to of claim 23, 
wherein said determining step further comprising: port information determination further comprises 
releasing said data packet from said first-in-first-out buffer after said network switch responds to 
said SNMP first and second requests. 

25. (Currently Amended) The method to monitor a n e twork switch according to of claim 23, 
wherein said determining stop further comprising: port information determination further comprises 
releasing said data packet from said first-in-first-out buffer after a predetermined period of time. 

26. (Currently Amended) The method to monitor a network switch according to of claim 14, 
further comprising^ maintaining at least one lookup table correlating said network address 
information with said port information. 

27. (Currently Amended) The method to monitor a network switch according to of claim 14, 
wherein said network switch is a routing switch. 

28. (Newly Added) A method to monitor a network switch, comprising: 

obtaining at least a portion of data packets being handled by said network switch, wherein 
each of said data packets comprises network address information; 
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extracting said network address information from said data packets; and 
determining port information of said network address information. 

29. (Newly Added) The method of claim 28, further comprising performing network analysis 
of said network switch using said port information. 

30. (Newly Added) The method of claim 28, wherein said port information comprises 
physical information of said network address information in said network switch. 

31. (Newly Added) The method of claim 28, wherein said port information comprises 
physical information of said network address information in said network switch. 

32. (Newly Added) The method of claim 28, said network switch having a plurality of 
regular ports and a mirror port, said mirror port being able to mirror network traffic for at least one 
of said regular ports, wherein said portion of data packets are obtained from said mirror port. 

33. (Newly Added) The method of claim 28, wherein said network address information 
comprises source addresses. 

34. (Newly Added) The method of claim 28, wherein said network address information 
comprises destination addresses. 

35. (Newly Added) The method of claim 28, said network switch comprising a plurality of 
regular ports, wherein said data packets are obtained by passively tapping at least one of said regular 
ports. 

36. (Newly Added) The method of claim 28, wherein said port information determination 
comprises interrogating said network switch to obtain said port information using said network 
address information. 

37. (Newly Added) The method of claim 36, wherein said interrogation: 
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sending a first request to said network switch requesting a port index corresponding to said 
network address information; and 

sending a second request to said network switch requesting said port information 
corresponding to said port index. 

38. (Newly Added) The method of claim 37, wherein said first request and said second 
request are SNMP requests. 

39. (Newly Added) The method of claim 37, wherein said port information determination 
comprises placing said data packets in a first-in-first-out buffer waiting for responses from said 
network switch. 

40. (Newly Added) The method of claim 39, wherein said port information determination 
further comprises releasing said data packet from said first-in-first-out buffer after said network 
switch responds to said first and second requests. 

41. (Newly Added) The method of claim 39, wherein said port information determination 
further comprises releasing said data packet from said first-in-first-out buffer after a predetermined 
period of time. 

42. (Newly Added) The method of claim 28, further comprising-: maintaining at least one 
lookup table correlating said network address information with said port information. 

43. (Newly Added) The method of claim 28, wherein said network switch is a routing switch. 

44. (Newly Added) The method of claim 28, further comprising associating the port 
information with information contained in the data packets. 

45. (Newly Added) The method of claim 44, further comprising performing network analysis 
of said network switch using said port information and associated data packet information. 
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